0xray 4.0.9 → 4.0.11

package/scripts/foundry/mint-suit.cjs

@@ -21,6 +21,9 @@ const DEFAULT_PARAMS = {
   agentsCard: "xray/AGENTS.md",
 };
 
+/** Factory shop plant. First-class with mill plant. Not 45/42 costume. */
+const FACTORY_SHOP_SKILLS = ["shop-extract", "shop-witness", "shop-pin"];
+
 function deepMerge(src, dest) {
   if (typeof src !== "object" || src === null) return dest !== undefined ? dest : src;
   if (Array.isArray(src)) return Array.isArray(dest) ? dest : src;
@@ -298,13 +301,59 @@ function wornAgentFiles(targetDir) {
   return listAgentFilesAt(path.join(targetDir, ".opencode", "agents"));
 }
 
+function normalizeNameList(value) {
+  if (!Array.isArray(value)) return [];
+  const names = [];
+  for (const item of value) {
+    if (typeof item !== "string") continue;
+    const name = item.trim();
+    if (name) names.push(name);
+  }
+  return names;
+}
+
+function shopPlantFromDir(targetDir, rel) {
+  const resolved = resolveInside(targetDir, rel);
+  if (!resolved || !isDirectory(resolved)) return [];
+  const nested = path.join(resolved, "skills");
+  return listSkillNamesAt(isDirectory(nested) ? nested : resolved);
+}
+
+function declaredShopPlant(targetDir) {
+  const raw = loadFoundryExtra(targetDir).shopPlant;
+  const names = [];
+  if (Array.isArray(raw)) {
+    names.push(...normalizeNameList(raw));
+  } else if (typeof raw === "string" && raw.trim()) {
+    names.push(...shopPlantFromDir(targetDir, raw.trim()));
+  } else if (raw && typeof raw === "object") {
+    names.push(...normalizeNameList(raw.skills));
+    if (typeof raw.dir === "string" && raw.dir.trim()) {
+      names.push(...shopPlantFromDir(targetDir, raw.dir.trim()));
+    }
+  }
+  return names;
+}
+
+/** Factory shop names plus foundry.json shopPlant. Not costume. */
+function loadShopPlant(targetDir) {
+  return [...new Set([...FACTORY_SHOP_SKILLS, ...declaredShopPlant(targetDir)])];
+}
+
 function previousTreeAllowlist(targetDir) {
   const file = path.join(targetDir, ".xray", "foundry-inventory.json");
   if (!fs.existsSync(file)) return { skills: [], agents: [] };
   try {
     const inventory = JSON.parse(fs.readFileSync(file, "utf8"));
+    const shopFromInv = inventory?.shopPlant;
+    const shopSkills = Array.isArray(shopFromInv)
+      ? normalizeNameList(shopFromInv)
+      : normalizeNameList(shopFromInv?.skills);
     return {
-      skills: Array.isArray(inventory?.tree?.skills) ? inventory.tree.skills : [],
+      skills: [
+        ...(Array.isArray(inventory?.tree?.skills) ? inventory.tree.skills : []),
+        ...shopSkills,
+      ],
       agents: Array.isArray(inventory?.tree?.agents) ? inventory.tree.agents : [],
     };
   } catch {
@@ -312,13 +361,15 @@ function previousTreeAllowlist(targetDir) {
   }
 }
 
-/** Extra worn names that are neither mill plant, their plant, nor a prior overlay. */
+/** Extra worn names that are neither mill plant, their plant, shop plant, nor a prior overlay. */
 function costumeDumpExtras(targetDir, millPlant, tree) {
   const prior = previousTreeAllowlist(targetDir);
+  const shopPlant = loadShopPlant(targetDir);
   const allowedSkills = new Set([
     ...(Array.isArray(millPlant?.skills) ? millPlant.skills : []),
     ...(Array.isArray(tree?.skills) ? tree.skills : []),
     ...prior.skills,
+    ...shopPlant,
   ]);
   const allowedAgents = new Set([
     ...(Array.isArray(millPlant?.agents) ? millPlant.agents : []),
@@ -427,6 +478,9 @@ function mintConsumerFromSsot(packageRoot, targetDir, log, tree) {
       skills: Array.isArray(tree?.millPlantSkills) ? tree.millPlantSkills : [],
       agents: Array.isArray(tree?.millPlantAgents) ? tree.millPlantAgents : [],
     },
+    shopPlant: {
+      skills: Array.isArray(tree?.shopPlantSkills) ? tree.shopPlantSkills : loadShopPlant(targetDir),
+    },
     costume,
     facets: {
       constitution,
@@ -465,6 +519,7 @@ function mintConsumerSuit(millPackageRoot, targetDir, log) {
   const tree = overlayConsumerTree(targetDir, log, params);
   tree.millPlantSkills = millPlant.skills;
   tree.millPlantAgents = millPlant.agents;
+  tree.shopPlantSkills = loadShopPlant(targetDir);
   tree.codex = overlayJsonFacet(
     resolveInside(targetDir, params.codex),
     path.join(targetDir, ".xray", "codex.json"),
@@ -491,9 +546,12 @@ function mintConsumerSuit(millPackageRoot, targetDir, log) {
 
 module.exports = {
   DEFAULT_PARAMS,
+  FACTORY_SHOP_SKILLS,
   deepMerge,
   loadFoundryParams,
   loadFoundryExtra,
+  loadShopPlant,
+  declaredShopPlant,
   wantsCostume,
   millPlantDir,
   listSkillNamesAt,

package/scripts/foundry/plant/skills/inspect/SKILL.md

@@ -12,7 +12,7 @@ Mill **does** these checks (`npx @0xray/foundry inspect`). Mint fails on a costu
 ## What mill inspects
 
 1. **Diff.** `git status` / `git diff --stat` of the milled cwd. Ignore the agent's summary if the diff disagrees.
-2. **Plant vs worn.** `src/skills`, `src/opencode/agents` vs `.opencode/skills`, `.opencode/agents`. Same name: plant wins. Costume dump (worn names they did not plant and mill did not fasten) fails mint unless `foundry.json` has `"costume": true`.
+2. **Plant vs worn.** `src/skills`, `src/opencode/agents` vs `.opencode/skills`, `.opencode/agents`. Same name: plant wins. Shop plant (`shop-extract`, `shop-witness`, `shop-pin`, plus `foundry.json` `shopPlant`) is first-class with mill plant. Costume dump (worn names they did not plant, mill did not fasten, and shop plant did not name) fails mint unless `foundry.json` has `"costume": true`.
 3. **Mill receipt.** `.xray/foundry-inventory.json` — mill name/version, `suit` (`fastened` / `overlay` / `costume`), `millPlant.skills` must include `mill` and `inspect`.
 4. **CI.** GitHub mill CI report (`.opencode/logs/ci-cd-monitor-report.json`), not a green check in chat. No token is a skip, not a pass invented.
 5. **Live PUT.** HTTP 200 on the npm `.tgz`. Metadata without a tarball is not shipped.

package/scripts/foundry/validate-release-docs.mjs

@@ -2,8 +2,8 @@
 /**
  * validate-release-docs.mjs — Blocking guard for release doc freshness.
  *
- * Ensures README, AGENTS, SKILLS, CHANGELOG, Docusaurus headers, and required
- * guides match package.json version and live framework counts before tag/publish.
+ * Ensures README, AGENTS, SKILLS, llms.txt, CHANGELOG, Docusaurus headers, and
+ * required guides match package.json version and mill law before tag/publish.
  *
  * Usage:
  *   npx @0xray/foundry docs-check
@@ -42,6 +42,24 @@ const REQUIRED_GUIDES = [
   'docs-site/docs/agents/README.md',
 ];
 
+function millLawLagErrors(content) {
+  const errors = [];
+  if (/Syncs \*\*45 framework skills\*\*/.test(content) || /syncs all 45 skills/i.test(content)) {
+    errors.push('lags mill law: default plant is mill+inspect, not 45-skill sync');
+  }
+  if (/SKILLS\.md \+ 45 skills → platform skill directories/.test(content)) {
+    errors.push('lags mill law: postinstall must not sync 45 skills as default plant');
+  }
+  return errors;
+}
+
+function millPlantMentionErrors(content) {
+  if (!content.includes('mill') || !content.includes('inspect')) {
+    return ['missing mill+inspect plant'];
+  }
+  return [];
+}
+
 const ROOT_DOC_CHECKS = [
   {
     rel: 'README.md',
@@ -62,6 +80,14 @@ const ROOT_DOC_CHECKS = [
       if (!content.includes('install-bridges') && !content.includes('installAllBridges')) {
         errors.push('missing install-bridges / installAllBridges reference');
       }
+      if (!content.includes('llms.txt')) {
+        errors.push('missing llms.txt agent-map reference');
+      }
+      if (!content.includes('shopPlant') && !content.includes('shop-extract')) {
+        errors.push('missing shop plant / shopPlant');
+      }
+      errors.push(...millPlantMentionErrors(content));
+      errors.push(...millLawLagErrors(content));
       return errors;
     },
   },
@@ -81,6 +107,11 @@ const ROOT_DOC_CHECKS = [
       if (!content.includes('SKILLS.md')) {
         errors.push('missing SKILLS.md link');
       }
+      if (!content.includes('llms.txt')) {
+        errors.push('missing llms.txt agent-map reference');
+      }
+      errors.push(...millPlantMentionErrors(content));
+      errors.push(...millLawLagErrors(content));
       return errors;
     },
   },
@@ -100,6 +131,11 @@ const ROOT_DOC_CHECKS = [
       if (!content.includes('AsideContext')) {
         errors.push('missing AsideContext section');
       }
+      if (!content.includes('shopPlant') && !content.includes('shop-extract')) {
+        errors.push('missing shop plant / shopPlant');
+      }
+      errors.push(...millPlantMentionErrors(content));
+      errors.push(...millLawLagErrors(content));
       return errors;
     },
   },
@@ -113,6 +149,37 @@ const ROOT_DOC_CHECKS = [
       if (!content.includes(`**${counts.skills} skills**`)) {
         errors.push(`skill count stale (expected **${counts.skills} skills**)`);
       }
+      errors.push(...millPlantMentionErrors(content));
+      errors.push(...millLawLagErrors(content));
+      return errors;
+    },
+  },
+  {
+    rel: 'llms.txt',
+    validate: (content) => {
+      const errors = [];
+      if (kernelLineHasPatchStamp(content)) {
+        errors.push('kernel header must be era (major.minor), not a patch stamp');
+      }
+      if (!content.includes('mill') || !content.includes('inspect')) {
+        errors.push('missing mill+inspect plant');
+      }
+      if (!content.includes('shopPlant') && !content.includes('shop-extract')) {
+        errors.push('missing hangar / shopPlant coexistence');
+      }
+      if (!content.includes('69')) {
+        errors.push('missing Codex 69');
+      }
+      if (!content.includes('xray-governance') || !content.includes('xray-orchestrator')) {
+        errors.push('missing 7 MCP agent map');
+      }
+      if (!content.toLowerCase().includes('costume')) {
+        errors.push('missing no-costume-dump law');
+      }
+      if (/^## Complete catalog/m.test(content) || content.includes('`api-design` · `architect-tools`')) {
+        errors.push('llms.txt must not costume-dump the 45-skill catalog');
+      }
+      errors.push(...millLawLagErrors(content));
       return errors;
     },
   },

package/scripts/foundry/version-manager.mjs

@@ -348,6 +348,7 @@ export function getReleaseArtifactPaths(baseDir = resolveMillRoot()) {
     'AGENTS.md',
     'AGENTS-consumer.md',
     'SKILLS.md',
+    'llms.txt',
     '.grok-plugin/plugin.json',
     'docs/README.md',
     'docs-site/docs/index.md',
@@ -366,6 +367,9 @@ export function getReleaseArtifactPaths(baseDir = resolveMillRoot()) {
     'docs-site/docs/architecture/GROK_GUIDE.md',
     'docs-site/sidebars.ts',
     'xray/features.json',
+    '.xray/features.json',
+    'docs/PIPELINE-FACET-SNAPSHOT.json',
+    'src/integrations/openclaw/plugin/xray-pre-tool/package.json',
   ];
   return candidates.filter((rel) => fs.existsSync(path.join(baseDir, rel)));
 }

package/scripts/node/bridge-mcp-wiring.cjs

@@ -39,6 +39,17 @@ function resolveRepertoireMcp(targetDir) {
   const candidates = [
     path.join(targetDir, "node_modules", "@0xray", "repertoire", "dist", "mcp", "server.js"),
     path.join(targetDir, "vendor", "@0xray", "repertoire", "dist", "mcp", "server.js"),
+    path.join(
+      targetDir,
+      "node_modules",
+      "0xray",
+      "vendor",
+      "@0xray",
+      "repertoire",
+      "dist",
+      "mcp",
+      "server.js",
+    ),
     isRepertoirePackageRoot(selfRoot) ? path.join(selfRoot, "dist", "mcp", "server.js") : null,
     isRepertoirePackageRoot(siblingRoot) ? path.join(siblingRoot, "dist", "mcp", "server.js") : null,
   ];
@@ -66,8 +77,20 @@ function resolveRepertoireProvider(targetDir) {
     "provider",
     "memory-routing-provider.js",
   );
+  const packedVendorProvider = path.join(
+    targetDir,
+    "node_modules",
+    "0xray",
+    "vendor",
+    "@0xray",
+    "repertoire",
+    "dist",
+    "provider",
+    "memory-routing-provider.js",
+  );
   if (fs.existsSync(nmProvider)) return nmProvider;
   if (fs.existsSync(vendorProvider)) return vendorProvider;
+  if (fs.existsSync(packedVendorProvider)) return packedVendorProvider;
   if (isRepertoirePackageRoot(siblingRoot) && fs.existsSync(siblingProvider)) return siblingProvider;
   return null;
 }

package/scripts/node/consumer-install-smoke.mjs

@@ -15,6 +15,7 @@ import os from "os";
 import path from "path";
 import { fileURLToPath } from "url";
 import { createRequire } from "module";
+import { proveSuitAfterInstall } from "./pack-tmp-suit-proof.mjs";
 
 const require = createRequire(import.meta.url);
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -39,6 +40,64 @@ function run(cmd, cwd, { inherit = false } = {}) {
   return inherit ? "" : String(result).trim();
 }
 
+function assertPackedPackageHasNoFileDeps(tarballPath) {
+  const packedJson = run(`tar -xOf ${JSON.stringify(tarballPath)} package/package.json`);
+  const packed = JSON.parse(packedJson);
+  const buckets = ["dependencies", "optionalDependencies", "peerDependencies"];
+  for (const bucket of buckets) {
+    const entries = packed[bucket] || {};
+    for (const [name, spec] of Object.entries(entries)) {
+      if (String(spec).startsWith("file:")) {
+        throw new Error(
+          `packed package.json must not ship file: ${bucket} ${name}=${spec} (consumers resolve file: from their root)`,
+        );
+      }
+    }
+  }
+  if (!String(packedJson).includes("vendor/@0xray/repertoire/")) {
+    const listing = run(`tar -tzf ${JSON.stringify(tarballPath)}`);
+    if (!listing.includes("package/vendor/@0xray/repertoire/package.json")) {
+      throw new Error("packed tarball missing vendor/@0xray/repertoire/package.json");
+    }
+  }
+  console.log("  ✅ packed package.json has no file: deps; vendor organ is in the tarball");
+}
+
+function assertOrganRequire(tmpRoot) {
+  const consumerRequire = createRequire(path.join(tmpRoot, "package.json"));
+  let organPkg;
+  try {
+    organPkg = consumerRequire("@0xray/repertoire/package.json");
+  } catch (err) {
+    throw new Error(`require('@0xray/repertoire') failed: ${err.message}`);
+  }
+  if (organPkg.name !== "@0xray/repertoire") {
+    throw new Error(`required organ name ${organPkg.name}`);
+  }
+  if (organPkg.version !== "0.2.0") {
+    throw new Error(`required organ version ${organPkg.version}`);
+  }
+  if (fs.existsSync(path.join(tmpRoot, "vendor"))) {
+    throw new Error("consumer install must not create or require a consumer-root vendor/ tree");
+  }
+  console.log("  ✅ require('@0xray/repertoire') from consumer cwd (no consumer vendor/)");
+}
+
+function writeBareConsumerManifest(tmpRoot) {
+  fs.writeFileSync(
+    path.join(tmpRoot, "package.json"),
+    `${JSON.stringify(
+      {
+        name: "xray-consumer-test",
+        version: "0.0.1",
+        private: true,
+      },
+      null,
+      2,
+    )}\n`,
+  );
+}
+
 function assertFreshInstallDefaults(tmpRoot, version) {
   const consumerFeaturesPath = path.join(tmpRoot, ".xray", "features.json");
   if (!fs.existsSync(consumerFeaturesPath)) {
@@ -188,25 +247,30 @@ function main() {
       throw new Error(`Tarball not found: ${tarballPath}`);
     }
 
-    const consumerPkg = {
-      name: "0xray-smoke-consumer",
-      private: true,
-      version: "1.0.0",
-      dependencies: {
-        "0xray": `file:${tarballPath}`,
-      },
-    };
-    fs.writeFileSync(
-      path.join(tmpRoot, "package.json"),
-      JSON.stringify(consumerPkg, null, 2) + "\n",
-    );
+    assertPackedPackageHasNoFileDeps(tarballPath);
+
+    writeBareConsumerManifest(tmpRoot);
 
-    console.log("📥 npm install (runs postinstall)...");
-    run("npm install", tmpRoot, { inherit: true });
+    console.log("📥 npm install tarball into bare consumer (exact ENOENT repro)...");
+    run(`npm install ${JSON.stringify(tarballPath)}`, tmpRoot, { inherit: true });
+
+    const installLinksRoot = fs.mkdtempSync(path.join(os.tmpdir(), "0xray-smoke-links-"));
+    writeBareConsumerManifest(installLinksRoot);
+    console.log("📥 npm install tarball --install-links (file: ENOENT path)...");
+    run(`npm install ${JSON.stringify(tarballPath)} --install-links`, installLinksRoot, {
+      inherit: true,
+    });
+    assertOrganRequire(installLinksRoot);
+    try {
+      fs.rmSync(installLinksRoot, { recursive: true, force: true });
+    } catch {
+      /* best-effort */
+    }
 
     const nmRoot = path.join(tmpRoot, "node_modules", "0xray");
     const requiredFiles = [
       "scripts/node/install-bridges.cjs",
+      "scripts/node/wear-vendored-repertoire.cjs",
       "scripts/node/postinstall.cjs",
       "scripts/foundry/mint-suit.cjs",
       "scripts/foundry/hooks.mjs",
@@ -274,6 +338,7 @@ function main() {
     console.log(`  ✅ .mcp.json has ${XRAY_MCP_NAMES.length} npx MCP servers`);
 
     assertFreshInstallDefaults(tmpRoot, version);
+    assertOrganRequire(tmpRoot);
 
     const schemaInPackage = path.join(nmRoot, "xray", "features.schema.json");
     if (!fs.existsSync(schemaInPackage)) {
@@ -283,6 +348,9 @@ function main() {
 
     runUpgradeMergeSmoke(tmpRoot, nmRoot, version);
 
+    console.log("\n📋 Pack → tmp mill fasten + hangar shop plant (not costume)...");
+    proveSuitAfterInstall(tmpRoot, path.join(nmRoot, "scripts", "foundry"));
+
     console.log("\n✅ Consumer install smoke passed\n");
   } catch (err) {
     console.error(`\n❌ Consumer smoke failed: ${err.message}\n`);

package/scripts/node/install-bridges.cjs

@@ -9,6 +9,7 @@ const path = require("path");
 const os = require("os");
 const { execSync } = require("child_process");
 const { wantsCostume, isIsolatedHome, machineHome } = require("../foundry/mint-suit.cjs");
+const { wearVendoredRepertoire } = require("./wear-vendored-repertoire.cjs");
 const {
   wireHermesBridge,
   wireOpencodeBridge,
@@ -742,6 +743,8 @@ function installAllBridges(opts) {
       /* noop */
     });
 
+  wearVendoredRepertoire(packageRoot, targetDir, log);
+
   if (!isConsumerInstall(packageRoot, targetDir)) {
     log("install-bridges", "framework dogfood wear", "info");
     installFrameworkDogfoodWear(packageRoot, log);
@@ -779,4 +782,5 @@ module.exports = {
   isEphemeralInstallRoot,
   isIsolatedHome,
   installFrameworkDogfoodWear,
+  wearVendoredRepertoire,
 };